Motivation

In SAP Sales and Service Cloud, license costs are based on the number of user licenses purchased. It is mandatory for customers to be compliant and stay within the purchased user limits. This blog explains which system users count towards the license, how to figure out which users are actually using the solution and how to bring these two metrics together in order to stay compliant with your license entitlement. The individual license types available in Sales and Service (core, add-on, editions) are out of scope for this blog.

Different user metrics

As a starting point it is crucial to know the different user metrics involved and understand the impact they have on license compliance.

Licensed Users: In SAP Sales and Service Cloud, license costs are based on the number of users licenses purchased. These “licensed users“ contain the set of users entitled to access the solution. For example, a customer might purchase 500 Sales Cloud user licenses – i.e. up to 500 users are entitled to access SAP Sales Cloud and use the corresponding sales capabilities of the solution.

Counted Users: From a license consumption point of view, every unlocked business user which is valid on a given date counts towards the license and is a so-called “counted user”. Technical users such as communication users generated within a Communication Arrangement and support users are not counted towards the license.

Active Users: “Active users” on the other hand are users actively logging into the solution and using its solution capabilities, such as creating opportunities or nurturing leads. These users need a user license if they want to continue using the solution going forward and should ideally be the only counted users in your tenant.

Monitoring user metrics

The different user metrics mentioned above can be monitored directly within the customer tenant:

• Licensed Users: The main Workcenter for monitoring user licenses and their respective consumption (i.e. counted users) is the Service Control Center (SCC). In the view “Counted User Overview” customers can check their purchased user license volume and consumption side-by-side. The “Usage” column indicates how many licenses are still remaining (i.e. unused) and a traffic light signals over- or underusage:

Counted User Overview in SCC

There is another view called “Purchased Licenses” which focuses on the purchased amount of user licenses. The Counted User Overview is more powerful however as it also shows the license consumption and should be used instead.

• Counted Users: The individual counted users can be checked via the Administration-Business Users Workcenter view. Per default this view shows a list of all business users in the system. The flag “Counted User” indicates whether a certain user is counted against the license. Remember this is the case if the user is unlocked and valid at the current date. You can filter the list on that attribute to show only the counted users in this tenant.

Business Users View in Admin WoC

In addition to maintaining business users and authorizations in this view, you can also assign individual users to purchased product licenses via the “Edit-User Subscriptions” action. Please note this is not a mandatory activity but provides transparency on which user consumes which specific license (e.g. Sales vs. Service in the old licensing model) for documentation purposes.

The counted users for a specific license type can also be seen in above mentioned “Counted Users Overview”. In the screenshot you can see “0” as no users have been assigned to a specific license type in our example.

• Active Users: When it comes to the actual active users logging into the solution and using its capabilities, customers have to dig a little deeper. SAP Sales and Service Cloud does not provide any standard WoC views showing this data, but there are reports which can be used to extract that information. These are reports focusing on login activity and on performance, some requiring an explicit opt-in / configuration to collect user-related data like user ID and IP address. One example for collecting the list of active users logging into the solution is the report “User Logon Activity”. As the name suggests this report compiles all relevant data related to login activity.

User Logon Activity Report in Analysis WoC

Please Note: In order to collect usage data in your Sales and Service Cloud tenant, the following scoping question needs to be activated beforehand: Administration – Performance and Usage Monitoring – User ID and IP Information Tracking. It is recommended to activate this scoping question as part of your go-live so accurate user metrics can be gathered. The active users can then be filtered by a specific time range (default is last 30 days). Please note that also technical users like integration users are part of this list, but can be filtered out by including flag “Technical User” into the selection criteria.

A slightly more differentiated view is provided by report “Screen Adoption by User”. Here customers can check screen adoption for their users. It might e.g. be that certain users logged into the solution at some point, but were not really using its capabilities like creating quotes or viewing leads. This can be revealed in this report and checked with the corresponding colleagues whether they still need access to the solution going forward.

Screen Adoption by User

The compliance problem

Now that we have an understanding of the different user metrics in SAP Sales and Service Cloud and how to monitor each metric, it is important to understand how all that affects your license compliance. As mentioned above, license compliance is measured by comparing the number of counted users with the number of purchased licenses. In real-life customers may run out of compliance over time even though the number of active users is still within the allowed thresholds defined by the license.

This can happen in the following cases:

• Manual employee creation via the UI: An employee can be created manually by the administrator via the Administration-Employees option – which will result in generation of the corresponding user. As soon as the administrator makes any changes to the user e.g. by adjusting the user ID or password policy this will result in a counted user – no matter whether the user is actually logging into the system or not.
• Mass-upload of employee data via the Data Workbench: In case many employees shall be uploaded to the system at once via the Data Workbench, the user validity and locking status can be specified as part of the data to be uploaded. In many cases customers simply generate counted users as part of this process – even though they might never be used for an actual logon. One reason could be that the employee is assigned to the account team for documentation purposes, but he is not using the solution himself (yet).
• Replication of employees from ERP: Another example could be an automatic replication of employee data from an ERP system such as ECC or S/4HANA. Here the corresponding user can also be set to active as part of this process. As per our standard ECC mapping, we set all users with active employment status to valid. This might not be desired for many customers though and result in many counted but unused users. In this case it is a good idea to adjust the pre-delivered mapping content to your needs, e.g. by locking all newly created users by default (see below).

Best practices to stay compliant with your license

This chapter describes some best practices which should be followed to align the counted user metric with the active user metric in order to stay compliant with your license usage.

Regularly check your license consumption

One important point to stay ahead of compliance issues is to regularly monitor your license consumption. The monitoring should happen at least 1-2 a year and after an additional region and/or department rollout. The recommended view to be used is the “Counted User Overview” of the SCC described above. If the license consumption is within the allowed limits, no further action is needed. If it is above the limits, you need to dig deeper.

Review active user count and solution adoption

If the license consumption exceeds the limits defined by the purchased volumes, you should get an overview of how many and which users are actually using the solution in the next step. This can be achieved by reviewing the “User Logon Activity” report or – even better – the “Screen Adoption by User” report. If you can see that the number of active users exceeds the purchased licenses and you can confirm that those users also need access to the solution going forward (also considering those cases where the user has logged into the solution but accessed no or very few Workcenters), you should contact your SAP Customer Success Partner (CSP) to buy additional licenses. If the number of active users is below the purchased license volumes but your license consumption exceeds it, you need to make sure to lock all inactive users in order to become compliant again. This is described in the next section.

Lock any inactive users

The next step in getting back into compliance is to lock all inactive users which frees up some of your licenses and reduces the number of counted users to below the license threshold. In the usage and adoption reports above you can extract the list of active users and compare it against the list of all unlocked business users (e.g. by accessing report “All Current Users” with filters for active/inactive and technical user flag or by downloading the list of all unlocked business users directly from within the Administration WoC or the Data Workbench / DWB). Next you can compare the 2 user sets and create a new list of all inactive users – which can be locked by setting the inactive flag via DWB.

As the above approach requires some manual activity to identify and lock all inactive users, a more convenient approach is to automatically lock all users after an inactivity period of 90 days. This can be configured via the following Business Configuration option: Administration-Performance and Usage Monitoring-User Management-Automatic Locking of Users: “Do you want to enable automatic locking of business users who have not logged-in in the last 90 days?”:

Automatic Locking of Users

Lock all users upon employee load, then unlock as needed

Another option to managing your license compliance is to be as restrictive as possible when uploading your users by locking them per default and only unlocking specific users as needed. The locking can be achieved by setting the “UserAccountsInactiveIndicator” in the Employee Replication iflow or the “User_Locked_Indicator” in the DWB template respectively. The administrator can subsequently unlock specific users in the Administrator UI or via DWB again. He should also assign the required business roles to these unlocked users to properly manage their authorizations.

Please Note: If you are managing the unlocking outside the iflow you need to set the “SkipIdentityUpdate” flag in the iflow, otherwise the iflow will lock the user again after every employee update in ERP.

Key takeaways

To summarize we can capture the following key takeaways:

• In SAP Sales and Service Cloud there is a differentiation between licensed, counted and active user metrics
• All unlocked valid users are counted users and consume a purchased user license item
• Any inactive users not using the solution should be locked in order to not be counted against the license and free up entitlements for other users
• To figure out the list of inactive and counted users various reports and WoC views are available in the solution
• The user cleanup can happen in several ways
  • One option is to regularly monitor the different user metrics and lock all inactive users manually
  • Another option could be to automatically lock users after an inactivity period of 3 months
  • The most restrictive option is to lock all users per default and selectively unlock only users which need access to the solution

Thanks for reading!